R524809
86 lines
4.2 KiB
Bash
86 lines
4.2 KiB
Bash
# Local PostgreSQL bootstrap administrator. It creates roles but must never be used by API or Worker.
|
|
POSTGRES_ADMIN_USER=atlas_admin
|
|
POSTGRES_ADMIN_PASSWORD=change-me-local-only
|
|
# Database name and host port exposed by local Docker Compose.
|
|
POSTGRES_DB=atlas
|
|
POSTGRES_PORT=5432
|
|
|
|
# Password for the schema-owning migrator role; only the migration runner may use it.
|
|
ATLAS_MIGRATOR_PASSWORD=change-me-local-only
|
|
# Password for the least-privileged API/Worker login role.
|
|
ATLAS_APP_PASSWORD=change-me-local-only
|
|
# API/Worker application connection. This role has no table ownership and is constrained by RLS.
|
|
DATABASE_URL=postgresql://atlas_app_login:change-me-local-only@localhost:5432/atlas
|
|
# Migration-only connection. Do not put this value in production API or Worker environments.
|
|
MIGRATOR_DATABASE_URL=postgresql://atlas_migrator:change-me-local-only@localhost:5432/atlas
|
|
|
|
# Runtime mode controls production-only safeguards such as Secure cookies.
|
|
NODE_ENV=development
|
|
# Browser origin allowed to send credentialed requests to this API.
|
|
WEB_ORIGIN=http://localhost:8100
|
|
# HTTP listener port for the NestJS API.
|
|
API_PORT=8200
|
|
|
|
# HMAC signing secret for short-lived access JWTs; replace with a unique 32+ character secret.
|
|
AUTH_JWT_SECRET=replace-with-a-random-secret-of-at-least-32-characters
|
|
# Separate HMAC secret used to pseudonymize IP/email values in Redis rate-limit keys.
|
|
AUTH_RATE_LIMIT_KEY_SECRET=replace-with-a-different-random-secret-of-at-least-32-characters
|
|
# AES-GCM 密钥材料，用来加密门店 API Key；只保存在服务端，轮换时变更版本号但保留旧密钥解密能力。
|
|
STORE_SECRET_ENCRYPTION_KEY=replace-with-a-random-secret-of-at-least-32-characters
|
|
# 当前门店密钥使用的加密密钥版本，会随密钥轮换递增。
|
|
STORE_SECRET_ENCRYPTION_KEY_VERSION=v1
|
|
# 对幂等请求内容生成 HMAC 摘要的独立密钥，避免数据库保存原始请求体或 API Key。
|
|
IDEMPOTENCY_KEY_SECRET=replace-with-a-different-random-secret-of-at-least-32-characters
|
|
# Server-side minimum password length. The browser must not weaken this rule.
|
|
AUTH_PASSWORD_MIN_LENGTH=12
|
|
# Maximum JSON or URL-encoded request size in bytes. Media files must use object-storage direct upload.
|
|
API_BODY_LIMIT_BYTES=1048576
|
|
# Shared fixed-window duration for authentication rate limits, in seconds.
|
|
AUTH_RATE_LIMIT_WINDOW_SECONDS=900
|
|
# Maximum login attempts per IP inside the window.
|
|
AUTH_LOGIN_IP_LIMIT=10
|
|
# Maximum login attempts per normalized email inside the window.
|
|
AUTH_LOGIN_EMAIL_LIMIT=5
|
|
# Maximum registration attempts per IP inside the window.
|
|
AUTH_REGISTER_IP_LIMIT=5
|
|
# Maximum registration attempts per normalized email inside the window.
|
|
AUTH_REGISTER_EMAIL_LIMIT=3
|
|
# Maximum refresh attempts per IP inside the window; refresh tokens have no trusted email before validation.
|
|
AUTH_REFRESH_IP_LIMIT=30
|
|
# 密码修改在同一限流窗口内允许的每 IP 最大次数。
|
|
AUTH_CHANGE_PASSWORD_IP_LIMIT=10
|
|
# 密码修改在同一限流窗口内允许的每已认证用户最大次数。
|
|
AUTH_CHANGE_PASSWORD_USER_LIMIT=5
|
|
|
|
# Comma-separated trusted reverse-proxy IPs/CIDRs. Keep empty for direct local access; never set to true.
|
|
TRUSTED_PROXY_CIDRS=
|
|
# Whether to expose Swagger UI at /api-docs.
|
|
SWAGGER_ENABLED=true
|
|
# Minimum structured-log severity: error, warn, log, or debug.
|
|
LOG_LEVEL=log
|
|
|
|
# Redis endpoint used by BullMQ and shared authentication rate limits.
|
|
REDIS_URL=redis://localhost:6379
|
|
|
|
# S3-compatible object storage. Local development falls back to MinIO root credentials above;
|
|
# production must set dedicated, least-privileged OBJECT_STORAGE_ACCESS_KEY / SECRET_KEY values.
|
|
OBJECT_STORAGE_ENDPOINT=http://localhost:9000
|
|
OBJECT_STORAGE_BUCKET=atlas-assets
|
|
OBJECT_STORAGE_FORCE_PATH_STYLE=true
|
|
# OBJECT_STORAGE_ACCESS_KEY=
|
|
# OBJECT_STORAGE_SECRET_KEY=
|
|
|
|
# Local MinIO root account; it is only for Docker bootstrap, not browser credentials.
|
|
MINIO_ROOT_USER=atlas_minio_local
|
|
# Local MinIO root password; replace outside disposable local development.
|
|
MINIO_ROOT_PASSWORD=change-me-local-only
|
|
# S3-compatible API port for local MinIO.
|
|
MINIO_PORT=9000
|
|
# MinIO administrative console port.
|
|
MINIO_CONSOLE_PORT=9001
|
|
|
|
# Local Vite frontend port.
|
|
WEB_PORT=8100
|
|
# Local WXT browser-extension development port.
|
|
EXTENSION_PORT=8110
|